Typically, IC card manufacturing steps include a set of phases each having a well defined purpose in terms of providing a specific characterization or functionality to the card. A first phase regards a functional configuration of the card while a last phase relates to a personalization phase. This personalization phase requires storing specific secret data and information in the smart card non-volatile memory to allow proper operation of the card in the designated application field.
The stored information identifies each smart card. The physical location in the non-volatile memory, where all data are stored, is an industrial secret of the manufacturer and is normally not within the scope of being standardized. As an example, the GSM communication standard defines the concept of authentication keys but does not standardize where the keys are to be stored on the card or the format representing and protecting such keys.
The methods for data storing should ensure secrecy of the memory location. In the IC card manufacturing steps, two different working states can also be distinguished that may be defined as ADMINISTRATIVE and SECURED.
In the ADMINISTRATIVE state a set of commands is available for the user or administrator to perform the functional configuration, accessing to each position in the smart card non-volatile memory. In the ADMINISTRATIVE state, free access to the memory ensures that the personalization process can be performed for storing all required data in known locations. The ADMINISTRATIVE state is also an intermediate state in which the smart card can stay for further production steps.
Only at the end of the production process will the smart card be placed in the SECURED state. The SECURED state is a final state in which the smart card is passed from the manufacturer to the customer. All secret data stored in the non-volatile memory of the card cannot be freely accessed anymore. If, for any reason, the personalization process is not performed by the manufacturer, it cannot be performed anymore.
FIG. 1 is a schematic view showing the action steps performed to reach the secured state from the administrative state. These steps are performed by the same manufacturer. This situation may be considered a restriction for providing a semi-finished production by a smart card manufacturer, since the final personalization in the secured state cannot be performed outside the factory. Therefore, this is a strong limitation to the possibility of supplying outside a predetermined number of micro-modules, that is, unfinished IC cards not yet protected in the secured state.
In such a case, when the personalization process should be performed by another organization or company, the only possibility to implement the personalization phase would be that of disclosing industrial secrets regarding the memory locations and the manner in which the card stores secret data.
Any disclosure of industrial secrets obviously need to be avoided by any smart card manufacturer. A known approach for providing personalization of an IC card is disclosed in U.S. Pat. No. 4,105,156 concerning an identification card with interior circuits and a memory for use in a credit or identification system.
This approach is specifically provided for bank services wherein a personal identification number, i.e., a PIN, is associated to a semi-finished IC card including a non-volatile memory portion. This personalization phase is performed by a user, generally a bank entity, by entering the PIN through a write/reader device of the IC card including an encoder. The PIN is fed into a memory through gates that are automatically destroyed so that the association between the card and the PIN can no longer be changed.
This hardware approach has the drawback that a wrong PIN or a wrong personalization code cannot be changed after the personalization enabling procedure is started. In other words, once the secret memory locations are used to store the personalization data, access to such memory locations is physically interrupted according to the teaching of the above U.S. patent.
Currently, personalization of IC cards are much more complex than a simple association of a PIN or code number. The hardware system disclosed in U.S. Pat. No. 4,105,156 would not be appropriate in large volumes of data and/or information required for the personalization step. A wrong instruction provided during the personalization phase would render a large number of IC cards inoperable. This corresponds to high costs being supported by the final user.
Therefore, it would be highly desirable for the final user to implement a personalization phase that could be defined in all possible details up to the last step of the personalization phase without destroying the possibility to re-program such a personalization phase. At the same time, the manufacturer of the IC is interested in offering to the final user a product having secret memory locations available for the personalization phase.